AI Agents Spark Cybersecurity Incidents at Two Thirds of Companies, CSA Report Finds

Artificial intelligence agents are rapidly becoming a staple in enterprise networks, but their unchecked deployment is causing serious trouble. According to a new report from the Cloud Security Alliance (CSA), conducted in partnership with Token Security, two thirds of organizations have suffered from AI agents cybersecurity incidents over the past year. These incidents have led to data exposure, operational disruptions, and financial losses, raising urgent questions about governance and oversight.

The report, titled Autonomous but Not Controlled: AI Agent Incidents Now Common in Enterprises, published on April 21, warns that most organizations lack a formal strategy for decommissioning AI agents. This oversight leaves them vulnerable to ongoing risks. As companies race to adopt AI, the gap between deployment and security is widening.

The Visibility Gap: Known vs. Unknown AI Agents

One of the most striking findings is the disconnect between perceived and actual visibility. While 68% of respondents expressed high confidence in their ability to track AI agents on their networks, 82% admitted to discovering previously unknown agents in the past year. This paradox highlights a critical blind spot.

Internal automation environments and large language model (LLM) platforms were the most common hiding spots for these rogue agents. The CSA report notes, “This gap highlights a distinction between operational visibility and complete governance assurance, limiting the effectiveness of control models that depend on known and bounded agents.”

When cybersecurity and infrastructure teams are unaware of AI agents deployed by employees, securing the network becomes nearly impossible. This lack of awareness has directly contributed to the rise in AI agents cybersecurity incidents.

Consequences: Data Exposure, Disruptions, and Financial Hits

The operational fallout from these incidents is significant. Among the 65% of organizations that experienced at least one incident, the most common consequences included data exposure (61%), operational disruption (43%), and unintended actions in business processes (41%).

Financial losses were reported by 35% of affected firms, while 31% faced delays in customer-facing or internal services. The paper warns that AI agent incidents are now hitting core enterprise functions, from data protection to service delivery. As the report states, “For organizations, this shifts AI agent governance from a technical oversight issue to a business risk management concern.”

Why Financial and Operational Risks Are Rising

Building on this, the report emphasizes that AI agent behavior must be integrated into broader security, compliance, and operational resilience strategies. Treating it as an isolated automation challenge is no longer viable. Companies must perform thorough risk assessments to apply appropriate controls.

The Decommissioning Problem: Forgotten Agents Pose Persistent Threats

Governance around AI agent decommissioning is particularly weak. Only one in five organizations have formal processes for retiring AI agents. As a result, many agents persist on networks long after their purpose is fulfilled.

These forgotten agents often retain credentials, permissions, or operational hooks. This creates a ticking time bomb for cybersecurity. The CSA warns that as more AI agents become part of enterprise networks, the problem of agent sprawl will only amplify risks. Without proper end-of-life governance, AI agents cybersecurity incidents will likely increase.

How to Strengthen AI Agent Security and Governance

In response to these challenges, the CSA has issued a set of actionable recommendations for organizations. Hillary Baron, assistant vice president of research at the CSA, explains, “AI agent security and governance encompass an interconnected system spanning visibility, lifecycle management, policy, and monitoring. While foundational controls are in place, gaps in consistency and end-of-life management remain.”

To address these gaps, the CSA advises firms to:

• Maintain visibility across AI agents — Ensure agents operating across SaaS platforms, internal systems, and LLM environments are identified and within governance scope.
• Define and document agent purpose — Establish intended functions to set operational boundaries and align access accordingly.
• Apply lifecycle governance consistently — Extend onboarding, ownership, review, and decommissioning processes across the full agent lifecycle.
• Evaluate actions based on risk and authorization — Use contextual signals such as action risk and explicit human approval to guide decision-making.
• Align monitoring with agent activity — Evolve from periodic oversight toward more continuous or event-driven detection models.
• Incorporate agents into enterprise risk models — Treat AI agents as part of broader security, compliance, and operational resilience frameworks.

For more insights on managing AI risks, check out our guide on AI security best practices. Additionally, learn about cloud security strategies to protect your digital assets.

As AI agents gain greater autonomy, governance must evolve into a more unified, operational model. The stakes are high, but with proactive measures, organizations can harness the power of AI without falling victim to its risks.

The Gentlemen Ransomware Expands With Rapid Affiliate Growth: What You Need to Know

The The Gentlemen ransomware operation is making headlines as a rapidly expanding ransomware-as-a-service (RaaS) group that has already claimed more than 320 victims. According to researchers at Check Point, the bulk of these attacks occurred in early 2026, signaling a sharp escalation in its activity.

First identified in mid-2025, this group has gained significant traction among affiliates by promoting its services on underground forums and recruiting technically skilled partners. But what sets The Gentlemen apart? Its modular tooling and cross-platform payloads are designed specifically for enterprise environments, making it a formidable threat.

How The Gentlemen Ransomware Recruits Affiliates

The success of The Gentlemen ransomware hinges on its affiliate model. The operation provides partners with ransomware variants written in the Go programming language, which support Windows, Linux, NAS, and BSD systems. Additionally, a separate ESXi encryptor developed in C is available for virtualized environments.

Affiliates are drawn to the platform because of its robust toolkit. This includes built-in lateral movement capabilities, credential reuse, and Group Policy-based deployment. These features allow attackers to trigger simultaneous encryption across domain environments with minimal effort.

Enterprise Impact: Multi-Platform Tooling in Action

In one observed case, attackers achieved domain controller access before deploying payloads across multiple systems. The activity included credential harvesting, remote execution via administrative shares, and widespread reconnaissance. The attackers also disabled endpoint protections and used scheduled tasks, services, and registry changes to maintain persistence.

Key capabilities observed in The Gentlemen attacks include:

• Cross-platform encryption covering endpoints, servers, and virtualized environments
• Automated lateral movement using stolen domain credentials
• Group Policy deployment for rapid, domain-wide execution
• Defense evasion through disabling antivirus and firewall protections

Furthermore, the ransomware terminates processes linked to databases, backup tools, and virtual machines to maximize impact. It also deletes shadow copies and logs to hinder recovery and forensic analysis.

SystemBC Use Suggests Broader Intrusion Ecosystem

During incident response, Check Point researchers identified the use of SystemBC, a proxy malware commonly associated with human-operated ransomware campaigns. This tool enables covert communication via SOCKS5 tunnels and can deliver additional payloads directly into memory.

Telemetry from a related command-and-control (C2) server revealed more than 1,570 infected systems globally. The distribution, heavily concentrated in the US, UK, and Germany, suggests a focus on organizational targets rather than opportunistic consumer infections.

However, it remains unclear whether SystemBC is fully integrated into The Gentlemen ecosystem or simply used by certain affiliates. Its presence alongside tools such as Cobalt Strike suggests a modular attack chain that can adapt to defenses.

When SystemBC deployment was blocked, attackers shifted to alternative C2 channels and established persistence using remote desktop and remote access software. This adaptability underscores the group’s sophistication.

What This Means for Cybersecurity Teams

The combination of scalable affiliate recruitment, enterprise-focused tooling, and integration with established post-exploitation frameworks increases the threat level significantly. Cybersecurity teams should prioritize monitoring for lateral movement indicators and Group Policy abuse.

For more insights, check out our guide on ransomware prevention strategies and learn about incident response planning. Additionally, stay updated on the latest cyber threats through threat intelligence reports.

In conclusion, The Gentlemen ransomware represents a new wave of RaaS operations that are more agile and dangerous than ever. Organizations must remain vigilant and invest in robust security measures to defend against these evolving threats.

Last Call: Bring a Partner to TechCrunch Disrupt 2026 and Save 50% on a Second Pass

The clock is ticking. With just two days left, TechCrunch Disrupt 2026 is offering a limited-time deal: buy one pass and get 50% off a second pass of the same type. This offer expires on May 8 at 11:59 p.m. PT. After that, prices increase, and the chance to bring a co-founder, partner, or colleague for half the cost disappears.

Why does this matter? Because attending alone limits your perspective. However, bringing someone alongside you doubles your ability to capture insights, test ideas, and leave with a clear action plan. This is especially critical for founders, investors, and operators navigating the fast-moving startup ecosystem.

Why Clarity Matters More Than Ever at Disrupt 2026

Success in the startup world hinges on making the right decisions—and making them quickly. Yet, the sheer volume of signals, opinions, and possible directions often leads to paralysis. Product development stalls. Investment timing gets delayed. Execution slows, not because the path is hidden, but because it’s buried under noise.

TechCrunch Disrupt 2026 compresses that uncertainty into three intensive days. You gain access to high-impact programming, unparalleled networking, and real-time insights from industry leaders actively shaping the market. As a result, you leave with clarity that’s difficult to replicate elsewhere.

This is where the Disrupt 2026 second pass 50% off deal becomes a strategic advantage. By bringing a trusted colleague, you can compare notes in real time, challenge assumptions, and refine your strategy while the context is still fresh.

Who You’ll Hear From at TechCrunch Disrupt 2026

The speaker lineup features some of the most influential voices in technology and venture capital. Confirmed speakers include:

• Nina Achadjian, Partner, Index Ventures
• Rajeev Dham, Managing Director, Sapphire Ventures
• Josh Reeves, CEO and Co-founder, Gusto
• Grant Lee, CEO and Co-founder, Gamma
• Shailendra Singh, Managing Director, Peak XV

These leaders will share tactical insights on fundraising, scaling, and market strategy. Additionally, the growing lineup promises even more depth across sectors like AI, fintech, and climate tech.

Watch Startup Battlefield 200: Where Trends Become Visible

One of the biggest advantages of attending Disrupt is witnessing how investment decisions actually unfold. The Startup Battlefield 200 competition showcases 200 early-stage startups pitching live to seasoned VC judges and a global audience. You’re not just observing—you’re learning what resonates, what gets challenged, and what ultimately stands out.

This level of transparency is rare. Therefore, being in the room—and locking in your pass while you can still bring someone for 50% off—matters more than trying to piece together these signals later from a recording or recap.

How a Second Pass Amplifies Your Experience

Clarity at Disrupt doesn’t come from any single session. Instead, it emerges from the patterns you notice across multiple talks, roundtables, and conversations. For founders, this might mean refining product direction. For investors, it’s about spotting what differentiates a breakout company. For operators, it’s pressure-testing how to build and scale efficiently.

Bringing a partner accelerates this process. You can compare interpretations in real time, challenge each other’s assumptions, and make better decisions while the context is still fresh. This is precisely why the TechCrunch Disrupt 2026 pass discount for a second ticket is more than a financial saving—it’s a strategic move.

Which Pass Type Fits You Best?

All pass types are eligible for the buy-one-get-50%-off-second deal. Here’s a quick breakdown:

• Founder Pass – Designed for startup builders. Includes investor meetings, the Deal Flow Café, curated networking, and programming on scaling, fundraising, and growth.
• Investor Pass – For VCs and angels. Connect directly with founders, access curated deal flow, and participate in investor-focused sessions.
• Attendee Pass – Ideal for operators and builders. Full access to stages, breakouts, roundtables, and networking.
• Non-profit Pass – Tailored for mission-driven organizations exploring how emerging tech applies to their work.
• Expo+ Pass – Focused access to the Expo Hall, breakouts, and networking for scouting talent and products.

For more details on each pass, check out our guide to Disrupt 2026 ticket options.

Two Days Left: Act Before May 8

The offer ends May 8 at 11:59 p.m. PT. If Disrupt is already on your radar, the decision now isn’t whether to attend—it’s whether you’re willing to move faster than those who wait. Especially when, for the next two days, you still have the opportunity to bring someone with you at 50% off.

Register before this week ends to secure these savings. After the deadline, you’re not just paying more—you’re making your next set of decisions without the clarity everyone else will be working from.

Don’t miss out. Register for TechCrunch Disrupt 2026 now and bring a colleague for half the cost.